diff --git a/packages/system/fluxcd-operator/charts/flux-operator/Chart.yaml b/packages/system/fluxcd-operator/charts/flux-operator/Chart.yaml index d59dedfa5..897216a17 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/Chart.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/Chart.yaml @@ -2,15 +2,15 @@ annotations: artifacthub.io/license: AGPL-3.0 artifacthub.io/links: | - name: Documentation - url: https://fluxcd.control-plane.io/operator + url: https://fluxoperator.dev/docs - name: Chart Source url: https://github.com/controlplaneio-fluxcd/charts - name: Upstream Project url: https://github.com/controlplaneio-fluxcd/flux-operator apiVersion: v2 -appVersion: v0.33.0 +appVersion: v0.48.0 description: 'A Helm chart for deploying the Flux Operator. ' -home: https://github.com/controlplaneio-fluxcd +home: https://fluxoperator.dev icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/flux/icon/color/flux-icon-color.png keywords: - flux @@ -25,4 +25,4 @@ sources: - https://github.com/controlplaneio-fluxcd/flux-operator - https://github.com/controlplaneio-fluxcd/charts type: application -version: 0.33.0 +version: 0.48.0 diff --git a/packages/system/fluxcd-operator/charts/flux-operator/README.md b/packages/system/fluxcd-operator/charts/flux-operator/README.md index 036fc534b..87a0fcd32 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/README.md +++ b/packages/system/fluxcd-operator/charts/flux-operator/README.md @@ -1,6 +1,6 @@ # flux-operator -![Version: 0.33.0](https://img.shields.io/badge/Version-0.33.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.33.0](https://img.shields.io/badge/AppVersion-v0.33.0-informational?style=flat-square) +![Version: 0.48.0](https://img.shields.io/badge/Version-0.48.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.48.0](https://img.shields.io/badge/AppVersion-v0.48.0-informational?style=flat-square) The [Flux Operator](https://github.com/controlplaneio-fluxcd/flux-operator) provides a declarative API for the installation and upgrade of CNCF [Flux](https://fluxcd.io) and the @@ -9,12 +9,15 @@ ControlPlane [enterprise distribution](https://control-plane.io/enterprise-for-f The operator automates the patching for hotfixes and CVEs affecting the Flux controllers container images and enables the configuration of multi-tenancy lockdown on Kubernetes and OpenShift clusters. +The operator comes with the Flux Status Page web UI exposed on port `9080` that allows users to visualize the +status of the Flux installation and monitor the GitOps delivery pipeline in real-time. + ## Prerequisites -- Kubernetes 1.22+ +- Kubernetes 1.30+ - Helm 3.8+ -## Installing the Chart +## Installing Flux Operator To install the operator in the `flux-system` namespace: @@ -25,8 +28,22 @@ helm install flux-operator oci://ghcr.io/controlplaneio-fluxcd/charts/flux-opera --wait ``` +## Installing the Flux Web UI as a Standalone Deployment + +You can install the Flux Status Web UI as a dedicated deployment in your Kubernetes cluster, +separate from the Flux Operator with: + +```console +helm install flux-web oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator \ + --namespace flux-system \ + --set fullnameOverride=flux-web \ + --set web.serverOnly=true \ + --set installCRDs=false \ + --wait +``` + To deploy the Flux controllers and to configure automated updates, -see the Flux Operator [documentation](https://fluxcd.control-plane.io/operator/). +see the Flux Operator [documentation](https://fluxoperator.dev/docs/). ## Values @@ -47,7 +64,7 @@ see the Flux Operator [documentation](https://fluxcd.control-plane.io/operator/) | livenessProbe | object | `{"httpGet":{"path":"/healthz","port":8081},"initialDelaySeconds":15,"periodSeconds":20}` | Container liveness probe settings. | | logLevel | string | `"info"` | Container logging level flag. | | marketplace | object | `{"account":"","license":"","type":""}` | Marketplace settings. | -| multitenancy | object | `{"defaultServiceAccount":"flux-operator","defaultWorkloadIdentityServiceAccount":"flux-operator","enabled":false,"enabledForWorkloadIdentity":false}` | Enable [multitenancy lockdown](https://fluxcd.control-plane.io/operator/resourceset/#role-based-access-control) for the ResourceSet APIs. | +| multitenancy | object | `{"defaultServiceAccount":"flux-operator","defaultWorkloadIdentityServiceAccount":"flux-operator","enabled":false,"enabledForWorkloadIdentity":false}` | Enable [multitenancy lockdown](https://fluxoperator.dev/docs/crd/resourceset/#role-based-access-control) for the ResourceSet APIs. | | nameOverride | string | `""` | | | nodeSelector | object | `{}` | Pod Node Selector settings. | | podSecurityContext | object | `{}` | Pod security context settings. | @@ -55,12 +72,21 @@ see the Flux Operator [documentation](https://fluxcd.control-plane.io/operator/) | rbac.create | bool | `true` | Grant the cluster-admin role to the flux-operator service account (required for the Flux Instance deployment). | | rbac.createAggregation | bool | `true` | Grant the Kubernetes view, edit and admin roles access to ResourceSet APIs. | | readinessProbe | object | `{"httpGet":{"path":"/readyz","port":8081},"initialDelaySeconds":5,"periodSeconds":10}` | Container readiness probe settings. | -| reporting | object | `{"interval":"5m"}` | Flux [reporting](https://fluxcd.control-plane.io/operator/fluxreport/) settings. | +| reporting | object | `{"interval":"5m"}` | Flux [reporting](https://fluxoperator.dev/docs/crd/fluxreport/) settings. | | resources | object | `{"limits":{"cpu":"2000m","memory":"1Gi"},"requests":{"cpu":"100m","memory":"64Mi"}}` | Container resources requests and limits settings. | | securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Container security context settings. The default is compliant with the pod security restricted profile. | | serviceAccount | object | `{"automount":true,"create":true,"name":""}` | Pod service account settings. The name of the service account defaults to the release name. | | serviceMonitor | object | `{"create":false,"interval":"60s","labels":{},"scrapeTimeout":"30s"}` | Prometheus Operator scraping settings. | | tolerations | list | `[]` | Pod tolerations settings. | +| web.config | object | `{}` | The spec of the [Web Config API](https://fluxoperator.dev/docs/web-ui/web-config-api/) | +| web.configSecretName | string | `""` | Reference to an existing Secret in the same namespace as the deployment containing the Web Config API. Should have the key `config.yaml`. | +| web.enabled | bool | `true` | Enable the [Flux Status web server](https://fluxoperator.dev/web-ui/) on port 9080. | +| web.httpRoute | object | `{"annotations":{},"enabled":false,"hostnames":[],"parentRefs":[]}` | Gateway API HTTPRoute settings for the Flux Status web interface. | +| web.ingress | object | `{"annotations":{},"className":"","enabled":false,"hosts":[],"tls":[]}` | Ingress settings for the Flux Status web interface. | +| web.networkPolicy | object | `{"create":true}` | Create a NetworkPolicy to allow access to the Flux Status web interface. | +| web.rbac | object | `{"createAggregation":false,"createRoles":true}` | Create standard roles for [user access management](https://fluxoperator.dev/docs/web-ui/user-management/). | +| web.serverOnly | bool | `false` | Run the Flux Status web server as a standalone deployment (requires a dedicated Helm release). | +| web.serverReplicas | int | `1` | Number of replicas for the Flux Status web server standalone deployment (only applicable if `web.serverOnly` is `true`). | ## Source Code diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/NOTES.txt b/packages/system/fluxcd-operator/charts/flux-operator/templates/NOTES.txt index b09e5e529..9af8d113e 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/NOTES.txt +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/NOTES.txt @@ -1 +1 @@ -Documentation at https://fluxcd.control-plane.io/operator/ +Documentation at https://fluxoperator.dev/docs/ diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/_helpers.tpl b/packages/system/fluxcd-operator/charts/flux-operator/templates/_helpers.tpl index 996d71d6e..ec6e44089 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/_helpers.tpl +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/_helpers.tpl @@ -56,3 +56,63 @@ Create the name of the service account to use {{- define "flux-operator.serviceAccountName" -}} {{- default (include "flux-operator.fullname" .) .Values.serviceAccount.name }} {{- end }} + +{{/* +Check if web config secret should be created. +Returns "true" when web is enabled, config is provided inline, and no external secret is referenced. +*/}} +{{- define "flux-operator.createWebConfigSecret" -}} +{{- if and .Values.web.enabled .Values.web.config (not .Values.web.configSecretName) -}} +true +{{- end -}} +{{- end }} + +{{/* +Check if an external web config secret is referenced. +Returns "true" when web is enabled, an external secret name is provided, and no inline config is set. +*/}} +{{- define "flux-operator.useWebConfigSecret" -}} +{{- if and .Values.web.enabled .Values.web.configSecretName (not .Values.web.config) -}} +true +{{- end -}} +{{- end }} + +{{/* +Check if running in web server only mode. +Returns "true" when web is enabled and serverOnly mode is set. +*/}} +{{- define "flux-operator.webServerOnly" -}} +{{- if and .Values.web.enabled .Values.web.serverOnly -}} +true +{{- end -}} +{{- end }} + +{{/* +Check if web server replicas should be set. +Returns "true" when web is enabled, serverOnly mode is set, and serverReplicas is greater than 1. +*/}} +{{- define "flux-operator.setWebServerReplicas" -}} +{{- if and .Values.web.enabled .Values.web.serverOnly (gt (int .Values.web.serverReplicas) 1) -}} +true +{{- end -}} +{{- end }} + +{{/* +Check if web roles should be created. +Returns "true" when web is enabled and createRoles is enabled. +*/}} +{{- define "flux-operator.createWebRoles" -}} +{{- if and .Values.web.enabled .Values.web.rbac.createRoles -}} +true +{{- end -}} +{{- end }} + +{{/* +Check if web roles aggregation should be created. +Returns "true" when web is enabled and createAggregation is enabled. +*/}} +{{- define "flux-operator.createWebRolesAggregation" -}} +{{- if and .Values.web.enabled .Values.web.rbac.createAggregation -}} +true +{{- end -}} +{{- end }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/admin-clusterrole.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/admin-clusterrole.yaml index abbf8990a..2e5f17bfc 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/admin-clusterrole.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/admin-clusterrole.yaml @@ -1,4 +1,4 @@ -{{- if .Values.rbac.create }} +{{- if and .Values.rbac.create (not (include "flux-operator.webServerOnly" .)) }} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/aggregate-clusterrole.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/aggregate-clusterrole.yaml index 86e9ba3f9..42c2cfee1 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/aggregate-clusterrole.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/aggregate-clusterrole.yaml @@ -1,4 +1,4 @@ -{{- if .Values.rbac.createAggregation }} +{{- if and .Values.rbac.createAggregation (not (include "flux-operator.webServerOnly" .)) }} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/crds.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/crds.yaml index fdd6fe76c..4549c3626 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/crds.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/crds.yaml @@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.20.0 helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: '{{ .Release.Name }}' @@ -164,7 +164,11 @@ spec: components: description: |- Components is the list of controllers to install. - Defaults to a commonly used subset. + Defaults to the core Flux controllers: + - source-controller + - kustomize-controller + - helm-controller + - notification-controller items: description: Component is the name of a controller to install. enum: @@ -211,6 +215,7 @@ spec: - upstream-alpine - enterprise-alpine - enterprise-distroless + - enterprise-distroless-fips type: string version: description: Version semver expression e.g. '2.x', '2.3.x'. @@ -618,7 +623,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.20.0 helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: '{{ .Release.Name }}' @@ -785,7 +790,7 @@ spec: failing: description: |- Failing is the number of reconciled - resources in the Failing state. + resources in the Failing state and not Suspended. type: integer running: description: |- @@ -921,7 +926,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.20.0 helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: '{{ .Release.Name }}' @@ -985,9 +990,9 @@ spec: - a PEM-encoded CA certificate (`ca.crt`) - a PEM-encoded client certificate (`tls.crt`) and private key (`tls.key`) - When connecting to a Git or OCI provider that uses self-signed certificates, the CA certificate - must be set in the Secret under the 'ca.crt' key to establish the trust relationship. - When connecting to an OCI provider that supports client certificates (mTLS), the client certificate + When connecting to a Git, OCI, or ExternalService provider that uses self-signed certificates, + the CA certificate must be set in the Secret under the 'ca.crt' key to establish the trust relationship. + When connecting to a provider that supports client certificates (mTLS), the client certificate and private key must be set in the Secret under the 'tls.crt' and 'tls.key' keys, respectively. properties: name: @@ -1013,6 +1018,11 @@ spec: ExcludeBranch specifies the regular expression to filter the branches that the input provider should exclude. type: string + excludeEnvironment: + description: |- + ExcludeEnvironment specifies the regular expression to filter the environments + that the input provider should exclude. + type: string excludeTag: description: |- ExcludeTag specifies the regular expression to filter the tags @@ -1023,6 +1033,11 @@ spec: IncludeBranch specifies the regular expression to filter the branches that the input provider should include. type: string + includeEnvironment: + description: |- + IncludeEnvironment specifies the regular expression to filter the environments + that the input provider should include. + type: string includeTag: description: |- IncludeTag specifies the regular expression to filter the tags @@ -1048,6 +1063,11 @@ spec: Supported only for tags at the moment. type: string type: object + insecure: + description: |- + Insecure allows connecting to an ExternalService or OCIArtifactTag provider + over plain HTTP without TLS. When not set, the URL must use HTTPS. + type: boolean schedule: description: Schedule defines the schedules for the input provider to run. @@ -1075,13 +1095,16 @@ spec: type: array secretRef: description: |- - SecretRef specifies the Kubernetes Secret containing the basic-auth credentials + SecretRef specifies the Kubernetes Secret containing the credentials to access the input provider. When connecting to a Git provider, the secret must contain the keys 'username' and 'password', and the password should be a personal access token that grants read-only access to the repository. When connecting to an OCI provider, the secret must contain a Kubernetes Image Pull Secret, as if created by `kubectl create secret docker-registry`. + When connecting to an ExternalService provider, the secret must contain either + a 'token' key for bearer token authentication, or 'username' and 'password' + keys for basic authentication. properties: name: description: Name of the referent. @@ -1119,13 +1142,18 @@ spec: - GitLabBranch - GitLabTag - GitLabMergeRequest + - GitLabEnvironment - AzureDevOpsBranch - AzureDevOpsTag - AzureDevOpsPullRequest + - GiteaBranch + - GiteaTag + - GiteaPullRequest - OCIArtifactTag - ACRArtifactTag - ECRArtifactTag - GARArtifactTag + - ExternalService type: string url: description: |- @@ -1151,6 +1179,16 @@ spec: - message: spec.url must start with 'oci://' when spec.type is an OCI provider rule: '!self.type.endsWith(''ArtifactTag'') || self.url.startsWith(''oci'')' + - message: spec.url must start with 'http://' or 'https://' when spec.type + is 'ExternalService' + rule: self.type != 'ExternalService' || self.url.startsWith('http') + - message: spec.insecure can only be set when spec.type is 'ExternalService' + or 'OCIArtifactTag' + rule: '!has(self.insecure) || !self.insecure || self.type == ''ExternalService'' + || self.type == ''OCIArtifactTag''' + - message: spec.url must use 'https://' unless spec.insecure is true + rule: self.type != 'ExternalService' || !self.url.startsWith('http://') + || (has(self.insecure) && self.insecure) - message: cannot specify spec.serviceAccountName when spec.type is not one of AzureDevOps* or *ArtifactTag rule: '!has(self.serviceAccountName) || self.type.startsWith(''AzureDevOps'') @@ -1289,7 +1327,7 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.19.0 + controller-gen.kubebuilder.io/version: v0.20.0 helm.sh/resource-policy: keep labels: app.kubernetes.io/instance: '{{ .Release.Name }}' @@ -1403,6 +1441,15 @@ spec: input provider objects are used. Defaults to flattening all inputs from all providers into a single list of input sets. properties: + includeEmptyProviders: + description: |- + IncludeEmptyProviders controls how input providers that export no + inputs are treated. Only applies when Name is Permute. When true, if + any provider has zero inputs the resulting permutation set is empty + (mathematically correct Cartesian product behavior). When false or + unset (default), providers with zero inputs are silently skipped and + the remaining providers still permute among themselves. + type: boolean name: description: |- Name defines how the inputs are combined when multiple @@ -1425,6 +1472,9 @@ spec: required: - name type: object + x-kubernetes-validations: + - message: includeEmptyProviders only applies when name is Permute + rule: '!has(self.includeEmptyProviders) || self.name == ''Permute''' inputs: description: Inputs contains the list of ResourceSet inputs. items: @@ -1603,6 +1653,16 @@ spec: - type type: object type: array + externalChecksumRefs: + description: |- + ExternalChecksumRefs lists the ConfigMap and Secret references + discovered in checksumFrom annotations on the last reconciliation + that point to objects not rendered by this ResourceSet. Each entry + has the form "Kind/namespace/name". It is used to trigger a + reconciliation when one of the referenced objects changes. + items: + type: string + type: array history: description: |- History contains the reconciliation history of the ResourceSet diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/deployment.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/deployment.yaml index cebc1cf10..e303ecf53 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/deployment.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/deployment.yaml @@ -13,6 +13,9 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: + {{- if include "flux-operator.setWebServerReplicas" . }} + replicas: {{ .Values.web.serverReplicas }} + {{- end }} selector: matchLabels: {{- include "flux-operator.selectorLabels" . | nindent 6 }} @@ -22,6 +25,9 @@ spec: prometheus.io/scrape: "true" prometheus.io/port: "8080" prometheus.io/path: "/metrics" + {{- if include "flux-operator.createWebConfigSecret" . }} + checksum/web-config: {{ (include (print $.Template.BasePath "/web-secret.yaml") . | fromYaml).stringData | toYaml | sha256sum }} + {{- end }} {{- with .Values.commonAnnotations }} {{- toYaml . | nindent 8 }} {{- end }} @@ -56,6 +62,15 @@ spec: {{- if .Values.multitenancy.enabledForWorkloadIdentity }} - --default-workload-identity-service-account={{ .Values.multitenancy.defaultWorkloadIdentityServiceAccount }} {{- end }} + {{- if include "flux-operator.webServerOnly" . }} + - --web-server-only=true + {{- end }} + {{- if include "flux-operator.createWebConfigSecret" . }} + - --web-config=/etc/flux-operator/web/config.yaml + {{- end }} + {{- if include "flux-operator.useWebConfigSecret" . }} + - --web-config-secret-name={{ .Values.web.configSecretName }} + {{- end }} {{- range .Values.extraArgs }} - {{ . }} {{- end }} @@ -66,6 +81,8 @@ spec: fieldPath: metadata.namespace - name: REPORTING_INTERVAL value: {{ .Values.reporting.interval }} + - name: WEB_SERVER_PORT + value: "{{ ternary "9080" "0" .Values.web.enabled }}" {{- with .Values.marketplace.type }} - name: MARKETPLACE_TYPE value: {{ . }} @@ -93,6 +110,11 @@ spec: - name: http containerPort: 8081 protocol: TCP + {{- if .Values.web.enabled }} + - name: http-web + containerPort: 9080 + protocol: TCP + {{- end }} livenessProbe: {{- toYaml .Values.livenessProbe | nindent 12 }} readinessProbe: @@ -102,12 +124,22 @@ spec: volumeMounts: - name: temp mountPath: /tmp + {{- if include "flux-operator.createWebConfigSecret" . }} + - name: web-config + mountPath: /etc/flux-operator/web + readOnly: true + {{- end }} {{- if .Values.extraVolumeMounts }} {{- toYaml .Values.extraVolumeMounts | nindent 12 }} {{- end }} volumes: - name: temp emptyDir: {} + {{- if include "flux-operator.createWebConfigSecret" . }} + - name: web-config + secret: + secretName: {{ include "flux-operator.fullname" . }}-web-config + {{- end }} {{- if .Values.extraVolumes }} {{- toYaml .Values.extraVolumes | nindent 8 }} {{- end }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/httproute.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/httproute.yaml new file mode 100644 index 000000000..1af8cadb5 --- /dev/null +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/httproute.yaml @@ -0,0 +1,26 @@ +{{- if .Values.web.httpRoute.enabled -}} +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: {{ include "flux-operator.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.web.httpRoute.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with .Values.web.httpRoute.parentRefs }} + parentRefs: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.web.httpRoute.hostnames }} + hostnames: + {{- toYaml . | nindent 4 }} + {{- end }} + rules: + - backendRefs: + - name: {{ include "flux-operator.fullname" . }} + port: 9080 +{{- end }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/ingress.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/ingress.yaml new file mode 100644 index 000000000..4f614ff92 --- /dev/null +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/ingress.yaml @@ -0,0 +1,44 @@ +{{- if .Values.web.ingress.enabled -}} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "flux-operator.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.web.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with .Values.web.ingress.className }} + ingressClassName: {{ . }} + {{- end }} + {{- if .Values.web.ingress.tls }} + tls: + {{- range .Values.web.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.web.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + {{- with .pathType }} + pathType: {{ . }} + {{- end }} + backend: + service: + name: {{ include "flux-operator.fullname" $ }} + port: + name: http-web + {{- end }} + {{- end }} +{{- end }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/network-policy.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/network-policy.yaml index f97ddba38..2e7e6be79 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/network-policy.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/network-policy.yaml @@ -14,6 +14,8 @@ spec: protocol: TCP - port: "8081" protocol: TCP + - port: "9080" + protocol: TCP ingress: - fromEntities: - cluster diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/networkpolicy.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/networkpolicy.yaml new file mode 100644 index 000000000..4c81bd10d --- /dev/null +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/networkpolicy.yaml @@ -0,0 +1,32 @@ +{{- if and .Values.web.enabled .Values.web.networkPolicy.create }} +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "flux-operator.fullname" . }}-web + namespace: {{ .Release.Namespace }} + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.commonLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.commonAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + policyTypes: + - Ingress + podSelector: + matchLabels: + {{- include "flux-operator.selectorLabels" . | nindent 6 }} + ingress: + - from: + - namespaceSelector: {} + ports: + - protocol: TCP + port: 9080 + {{- if .Values.serviceMonitor.create }} + - protocol: TCP + port: 8080 + {{- end }} +{{- end }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/service.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/service.yaml index 37ad04c2f..a5c73ca5f 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/templates/service.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/service.yaml @@ -18,5 +18,11 @@ spec: targetPort: http-metrics protocol: TCP name: http + {{- if .Values.web.enabled }} + - port: 9080 + targetPort: http-web + protocol: TCP + name: http-web + {{- end }} selector: {{- include "flux-operator.selectorLabels" . | nindent 4 }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/web-clusterrole.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/web-clusterrole.yaml new file mode 100644 index 000000000..1cc312566 --- /dev/null +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/web-clusterrole.yaml @@ -0,0 +1,47 @@ +{{- if include "flux-operator.webServerOnly" . }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "flux-operator.fullname" . }}-view + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.commonLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.commonAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create"] + - apiGroups: [""] + resources: ["users", "groups"] + verbs: ["impersonate"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "flux-operator.fullname" . }} + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.commonLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.commonAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "flux-operator.fullname" . }}-view +subjects: + - kind: ServiceAccount + name: {{ include "flux-operator.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/web-secret.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/web-secret.yaml new file mode 100644 index 000000000..c019f77c9 --- /dev/null +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/web-secret.yaml @@ -0,0 +1,26 @@ +{{- if and .Values.web.config .Values.web.configSecretName -}} +{{- fail "Invalid values: 'web.config' and 'web.configSecretName' cannot both be set. Set at most one." -}} +{{- end -}} +{{- if include "flux-operator.createWebConfigSecret" . -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "flux-operator.fullname" . }}-web-config + namespace: {{ .Release.Namespace }} + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.commonLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.commonAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +type: Opaque +stringData: + config.yaml: | + apiVersion: web.fluxcd.controlplane.io/v1 + kind: Config + spec: + {{- toYaml .Values.web.config | nindent 6 }} +{{- end }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/templates/web-standard-roles.yaml b/packages/system/fluxcd-operator/charts/flux-operator/templates/web-standard-roles.yaml new file mode 100644 index 000000000..085d1d6ac --- /dev/null +++ b/packages/system/fluxcd-operator/charts/flux-operator/templates/web-standard-roles.yaml @@ -0,0 +1,131 @@ +{{- if include "flux-operator.createWebRoles" . }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: flux-web-user + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.commonLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.commonAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: flux-web-admin + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.commonLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.commonAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["get", "list", "watch"] + - apiGroups: + - fluxcd.controlplane.io + - source.toolkit.fluxcd.io + - source.extensions.fluxcd.io + - kustomize.toolkit.fluxcd.io + - helm.toolkit.fluxcd.io + - image.toolkit.fluxcd.io + - notification.toolkit.fluxcd.io + resources: ["*"] + verbs: + - patch + - reconcile + - suspend + - resume + - download + - apiGroups: + - apps + resources: + - deployments + - statefulsets + - daemonsets + verbs: + - patch + - restart + - apiGroups: + - batch + resources: + - cronjobs + - jobs + verbs: + - create + - restart + - apiGroups: + - "" + resources: + - pods + verbs: + - delete +{{- end }} +{{- if include "flux-operator.createWebRolesAggregation" . }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: flux-web-edit + labels: + {{- include "flux-operator.labels" . | nindent 4 }} + {{- with .Values.commonLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + rbac.authorization.k8s.io/aggregate-to-edit: "true" + {{- with .Values.commonAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +rules: + - apiGroups: + - fluxcd.controlplane.io + - source.toolkit.fluxcd.io + - source.extensions.fluxcd.io + - kustomize.toolkit.fluxcd.io + - helm.toolkit.fluxcd.io + - image.toolkit.fluxcd.io + - notification.toolkit.fluxcd.io + resources: + - '*' + verbs: + - reconcile + - suspend + - resume + - download + - apiGroups: + - apps + resources: + - deployments + - statefulsets + - daemonsets + verbs: + - patch + - restart + - apiGroups: + - batch + resources: + - cronjobs + - jobs + verbs: + - create + - restart + - apiGroups: + - "" + resources: + - pods + verbs: + - delete +{{- end }} diff --git a/packages/system/fluxcd-operator/charts/flux-operator/values.schema.json b/packages/system/fluxcd-operator/charts/flux-operator/values.schema.json index 6c42d4f84..17f4f2405 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/values.schema.json +++ b/packages/system/fluxcd-operator/charts/flux-operator/values.schema.json @@ -425,6 +425,115 @@ "items": { "type": "object" } + }, + "web": { + "type": "object", + "properties": { + "config": { + "type": "object" + }, + "configSecretName": { + "default": "", + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "httpRoute": { + "default": { + "annotations": {}, + "enabled": false, + "hostnames": [], + "parentRefs": [] + }, + "type": "object", + "properties": { + "annotations": { + "type": "object" + }, + "enabled": { + "default": false, + "type": "boolean" + }, + "hostnames": { + "type": "array", + "uniqueItems": true, + "items": { + "type": "string" + } + }, + "parentRefs": { + "type": "array", + "uniqueItems": true, + "items": { + "type": "object" + } + } + } + }, + "ingress": { + "default": { + "annotations": {}, + "className": "", + "enabled": false + }, + "type": "object", + "properties": { + "annotations": { + "type": "object" + }, + "className": { + "type": "string" + }, + "enabled": { + "default": false, + "type": "boolean" + }, + "hosts": { + "type": "array", + "uniqueItems": true, + "items": { + "type": "object" + } + }, + "tls": { + "type": "array", + "uniqueItems": true, + "items": { + "type": "object" + } + } + } + }, + "networkPolicy": { + "type": "object", + "properties": { + "create": { + "type": "boolean" + } + } + }, + "rbac": { + "type": "object", + "properties": { + "createAggregation": { + "default": false, + "type": "boolean" + }, + "createRoles": { + "default": true, + "type": "boolean" + } + } + }, + "serverOnly": { + "type": "boolean" + }, + "serverReplicas": { + "default": 1, + "type": "integer" + } + } } } } diff --git a/packages/system/fluxcd-operator/charts/flux-operator/values.yaml b/packages/system/fluxcd-operator/charts/flux-operator/values.yaml index aa2a6b59a..d10d6ea07 100644 --- a/packages/system/fluxcd-operator/charts/flux-operator/values.yaml +++ b/packages/system/fluxcd-operator/charts/flux-operator/values.yaml @@ -3,17 +3,60 @@ nameOverride: "" fullnameOverride: "" -# -- Enable [multitenancy lockdown](https://fluxcd.control-plane.io/operator/resourceset/#role-based-access-control) for the ResourceSet APIs. +# -- Enable [multitenancy lockdown](https://fluxoperator.dev/docs/crd/resourceset/#role-based-access-control) for the ResourceSet APIs. multitenancy: enabled: false enabledForWorkloadIdentity: false defaultServiceAccount: "flux-operator" # @schema required: true defaultWorkloadIdentityServiceAccount: "flux-operator" # @schema required: true -# -- Flux [reporting](https://fluxcd.control-plane.io/operator/fluxreport/) settings. +# -- Flux [reporting](https://fluxoperator.dev/docs/crd/fluxreport/) settings. reporting: interval: 5m # @schema required: true +web: + # -- Enable the [Flux Status web server](https://fluxoperator.dev/web-ui/) on port 9080. + enabled: true + # -- The spec of the [Web Config API](https://fluxoperator.dev/docs/web-ui/web-config-api/) + config: { } # @schema type: object + # -- Reference to an existing Secret in the same namespace as the deployment containing the Web Config API. Should have the key `config.yaml`. + configSecretName: "" # @schema default: "" + # -- Create a NetworkPolicy to allow access to the Flux Status web interface. + networkPolicy: + create: true + # -- Create standard roles for [user access management](https://fluxoperator.dev/docs/web-ui/user-management/). + rbac: + createRoles: true # @schema default: true + createAggregation: false # @schema default: false + # -- Run the Flux Status web server as a standalone deployment (requires a dedicated Helm release). + serverOnly: false + # -- Number of replicas for the Flux Status web server standalone deployment (only applicable if `web.serverOnly` is `true`). + serverReplicas: 1 # @schema default: 1 + # -- Ingress settings for the Flux Status web interface. + ingress: # @schema default: {"enabled":false,"className":"","annotations":{}} + enabled: false # @schema default: false + className: "" + annotations: { } # @schema type: object + hosts: [ ] # @schema item: object ; uniqueItems: true + # - host: flux-operator.example.com + # paths: + # - path: / + # pathType: ImplementationSpecific + tls: [ ] # @schema item: object ; uniqueItems: true + # - secretName: flux-operator-tls + # hosts: + # - flux-operator.example.com + # -- Gateway API HTTPRoute settings for the Flux Status web interface. + httpRoute: # @schema default: {"enabled":false,"annotations":{},"parentRefs":[],"hostnames":[]} + enabled: false # @schema default: false + annotations: { } # @schema type: object + parentRefs: [ ] # @schema item: object ; uniqueItems: true + # - name: my-gateway + # namespace: gateway-system + # sectionName: https + hostnames: [ ] # @schema item: string ; uniqueItems: true + # - flux.example.com + # -- Install and upgrade the custom resource definitions. installCRDs: true # @schema default: true diff --git a/packages/system/fluxcd-operator/patches/networkPolicy.diff b/packages/system/fluxcd-operator/patches/networkPolicy.diff index e074ae2f7..1c478de7f 100644 --- a/packages/system/fluxcd-operator/patches/networkPolicy.diff +++ b/packages/system/fluxcd-operator/patches/networkPolicy.diff @@ -2,7 +2,7 @@ diff --git a/charts/flux-operator/templates/network-policy.yaml b/packages/syste new file mode 100644 --- /dev/null (revision 52a23eacfc32430d8b008b765c64a81526521bae) +++ b/charts/flux-operator/templates/network-policy.yaml (revision 52a23eacfc32430d8b008b765c64a81526521bae) -@@ -0,0 +1,20 @@ +@@ -0,0 +1,22 @@ +{{- if .Capabilities.APIVersions.Has "cilium.io/v2/CiliumClusterwideNetworkPolicy" }} +apiVersion: cilium.io/v2 +kind: CiliumClusterwideNetworkPolicy @@ -19,6 +19,8 @@ new file mode 100644 + protocol: TCP + - port: "8081" + protocol: TCP ++ - port: "9080" ++ protocol: TCP + ingress: + - fromEntities: + - cluster diff --git a/packages/system/fluxcd-operator/values.yaml b/packages/system/fluxcd-operator/values.yaml index 9053689a0..793fea333 100644 --- a/packages/system/fluxcd-operator/values.yaml +++ b/packages/system/fluxcd-operator/values.yaml @@ -12,3 +12,7 @@ flux-operator: requests: cpu: 100m memory: 350Mi + # Flux Status Web UI is opt-in. Override `web.enabled: true` (and configure + # `web.config` / `web.configSecretName` / `web.ingress` as needed) to enable. + web: + enabled: false diff --git a/packages/system/fluxcd/charts/flux-instance/Chart.yaml b/packages/system/fluxcd/charts/flux-instance/Chart.yaml index 448e66005..9d1272ead 100644 --- a/packages/system/fluxcd/charts/flux-instance/Chart.yaml +++ b/packages/system/fluxcd/charts/flux-instance/Chart.yaml @@ -2,15 +2,15 @@ annotations: artifacthub.io/license: AGPL-3.0 artifacthub.io/links: | - name: Documentation - url: https://fluxcd.control-plane.io/operator + url: https://fluxoperator.dev/docs - name: Chart Source url: https://github.com/controlplaneio-fluxcd/charts - name: Upstream Project url: https://github.com/controlplaneio-fluxcd/flux-operator apiVersion: v2 -appVersion: v0.33.0 +appVersion: v0.48.0 description: 'A Helm chart for deploying a Flux instance managed by Flux Operator. ' -home: https://github.com/controlplaneio-fluxcd +home: https://fluxoperator.dev icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/flux/icon/color/flux-icon-color.png keywords: - flux @@ -25,4 +25,4 @@ sources: - https://github.com/controlplaneio-fluxcd/flux-operator - https://github.com/controlplaneio-fluxcd/charts type: application -version: 0.33.0 +version: 0.48.0 diff --git a/packages/system/fluxcd/charts/flux-instance/README.md b/packages/system/fluxcd/charts/flux-instance/README.md index e788edf16..50b6139ab 100644 --- a/packages/system/fluxcd/charts/flux-instance/README.md +++ b/packages/system/fluxcd/charts/flux-instance/README.md @@ -1,6 +1,6 @@ # flux-instance -![Version: 0.33.0](https://img.shields.io/badge/Version-0.33.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.33.0](https://img.shields.io/badge/AppVersion-v0.33.0-informational?style=flat-square) +![Version: 0.48.0](https://img.shields.io/badge/Version-0.48.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.48.0](https://img.shields.io/badge/AppVersion-v0.48.0-informational?style=flat-square) This chart is a thin wrapper around the `FluxInstance` custom resource, which is used by the [Flux Operator](https://github.com/controlplaneio-fluxcd/flux-operator) @@ -8,7 +8,7 @@ to install, configure and automatically upgrade Flux. ## Prerequisites -- Kubernetes 1.22+ +- Kubernetes 1.30+ - Helm 3.8+ ## Installing the Chart @@ -20,7 +20,7 @@ helm -n flux-system install flux oci://ghcr.io/controlplaneio-fluxcd/charts/flux ``` For more information on the available configuration options, -see the [Flux Instance documentation](https://fluxcd.control-plane.io/operator/fluxinstance/). +see the [Flux Instance documentation](https://fluxoperator.dev/docs/crd/fluxinstance/). ## Uninstalling the Chart @@ -39,14 +39,14 @@ helm -n flux-system uninstall flux | fullnameOverride | string | `"flux"` | | | healthcheck.enabled | bool | `false` | Enable post-install and post-upgrade health checks. | | healthcheck.timeout | string | `"5m"` | Health check timeout in Go duration format. | -| instance.cluster | object | `{"domain":"cluster.local","multitenant":false,"networkPolicy":true,"size":"","tenantDefaultServiceAccount":"default","type":"kubernetes"}` | Cluster https://fluxcd.control-plane.io/operator/fluxinstance/#cluster-configuration | -| instance.commonMetadata | object | `{"annotations":{},"labels":{}}` | Common metadata https://fluxcd.control-plane.io/operator/fluxinstance/#common-metadata | -| instance.components | list | `["source-controller","kustomize-controller","helm-controller","notification-controller"]` | Components https://fluxcd.control-plane.io/operator/fluxinstance/#components-configuration | -| instance.distribution | object | `{"artifact":"oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:latest","artifactPullSecret":"","imagePullSecret":"","registry":"ghcr.io/fluxcd","version":"2.x"}` | Distribution https://fluxcd.control-plane.io/operator/fluxinstance/#distribution-configuration | -| instance.kustomize.patches | list | `[]` | Kustomize patches https://fluxcd.control-plane.io/operator/fluxinstance/#kustomize-patches | -| instance.sharding | object | `{"key":"sharding.fluxcd.io/key","shards":[]}` | Sharding https://fluxcd.control-plane.io/operator/fluxinstance/#sharding-configuration | -| instance.storage | object | `{"class":"","size":""}` | Storage https://fluxcd.control-plane.io/operator/fluxinstance/#storage-configuration | -| instance.sync | object | `{"interval":"1m","kind":"GitRepository","name":"","path":"","provider":"","pullSecret":"","ref":"","url":""}` | Sync https://fluxcd.control-plane.io/operator/fluxinstance/#sync-configuration | +| instance.cluster | object | `{"domain":"cluster.local","multitenant":false,"networkPolicy":true,"size":"","tenantDefaultServiceAccount":"default","type":"kubernetes"}` | Cluster https://fluxoperator.dev/docs/crd/fluxinstance/#cluster-configuration | +| instance.commonMetadata | object | `{"annotations":{},"labels":{}}` | Common metadata https://fluxoperator.dev/docs/crd/fluxinstance/#common-metadata | +| instance.components | list | `["source-controller","kustomize-controller","helm-controller","notification-controller"]` | Components https://fluxoperator.dev/docs/crd/fluxinstance/#components-configuration | +| instance.distribution | object | `{"artifact":"oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:latest","artifactPullSecret":"","imagePullSecret":"","registry":"ghcr.io/fluxcd","variant":"","version":"2.x"}` | Distribution https://fluxoperator.dev/docs/crd/fluxinstance/#distribution-configuration | +| instance.kustomize.patches | list | `[]` | Kustomize patches https://fluxoperator.dev/docs/crd/fluxinstance/#kustomize-patches | +| instance.sharding | object | `{"key":"sharding.fluxcd.io/key","shards":[]}` | Sharding https://fluxoperator.dev/docs/crd/fluxinstance/#sharding-configuration | +| instance.storage | object | `{"class":"","size":""}` | Storage https://fluxoperator.dev/docs/crd/fluxinstance/#storage-configuration | +| instance.sync | object | `{"interval":"1m","kind":"GitRepository","name":"","path":"","provider":"","pullSecret":"","ref":"","url":""}` | Sync https://fluxoperator.dev/docs/crd/fluxinstance/#sync-configuration | | nameOverride | string | `""` | | ## Source Code diff --git a/packages/system/fluxcd/charts/flux-instance/templates/NOTES.txt b/packages/system/fluxcd/charts/flux-instance/templates/NOTES.txt index b09e5e529..9af8d113e 100644 --- a/packages/system/fluxcd/charts/flux-instance/templates/NOTES.txt +++ b/packages/system/fluxcd/charts/flux-instance/templates/NOTES.txt @@ -1 +1 @@ -Documentation at https://fluxcd.control-plane.io/operator/ +Documentation at https://fluxoperator.dev/docs/ diff --git a/packages/system/fluxcd/charts/flux-instance/templates/healthcheck.yaml b/packages/system/fluxcd/charts/flux-instance/templates/healthcheck.yaml index 41329d827..254e8ae1d 100644 --- a/packages/system/fluxcd/charts/flux-instance/templates/healthcheck.yaml +++ b/packages/system/fluxcd/charts/flux-instance/templates/healthcheck.yaml @@ -3,6 +3,7 @@ apiVersion: batch/v1 kind: Job metadata: name: "{{ .Release.Name }}-healthcheck" + namespace: {{ .Release.Namespace }} labels: app.kubernetes.io/managed-by: {{ .Release.Service | quote }} app.kubernetes.io/instance: {{ .Release.Name | quote }} diff --git a/packages/system/fluxcd/charts/flux-instance/templates/instance.yaml b/packages/system/fluxcd/charts/flux-instance/templates/instance.yaml index 576888116..f1f58309e 100644 --- a/packages/system/fluxcd/charts/flux-instance/templates/instance.yaml +++ b/packages/system/fluxcd/charts/flux-instance/templates/instance.yaml @@ -14,7 +14,7 @@ metadata: {{- end }} spec: distribution: - version: {{ .Values.instance.distribution.version }} + version: {{ .Values.instance.distribution.version | quote }} registry: {{ .Values.instance.distribution.registry }} artifact: {{ .Values.instance.distribution.artifact }} {{- if .Values.instance.distribution.artifactPullSecret }} @@ -23,6 +23,9 @@ spec: {{- if .Values.instance.distribution.imagePullSecret }} imagePullSecret: {{ .Values.instance.distribution.imagePullSecret }} {{- end }} + {{- if .Values.instance.distribution.variant }} + variant: {{ .Values.instance.distribution.variant }} + {{- end }} components: {{ .Values.instance.components | toYaml | nindent 4 }} cluster: {{- range $key, $value := .Values.instance.cluster }} diff --git a/packages/system/fluxcd/charts/flux-instance/values.schema.json b/packages/system/fluxcd/charts/flux-instance/values.schema.json index af0e7b1a5..d6f6c3182 100644 --- a/packages/system/fluxcd/charts/flux-instance/values.schema.json +++ b/packages/system/fluxcd/charts/flux-instance/values.schema.json @@ -350,6 +350,16 @@ "registry": { "type": "string" }, + "variant": { + "type": "string", + "enum": [ + "", + "upstream-alpine", + "enterprise-alpine", + "enterprise-distroless", + "enterprise-distroless-fips" + ] + }, "version": { "type": "string" } diff --git a/packages/system/fluxcd/charts/flux-instance/values.yaml b/packages/system/fluxcd/charts/flux-instance/values.yaml index 84619eca2..84e16cb03 100644 --- a/packages/system/fluxcd/charts/flux-instance/values.yaml +++ b/packages/system/fluxcd/charts/flux-instance/values.yaml @@ -4,20 +4,21 @@ nameOverride: "" fullnameOverride: "flux" instance: - # -- Distribution https://fluxcd.control-plane.io/operator/fluxinstance/#distribution-configuration + # -- Distribution https://fluxoperator.dev/docs/crd/fluxinstance/#distribution-configuration distribution: # @schema required: true version: "2.x" # @schema required: true registry: "ghcr.io/fluxcd" # @schema required: true artifact: "oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:latest" artifactPullSecret: "" imagePullSecret: "" - # -- Components https://fluxcd.control-plane.io/operator/fluxinstance/#components-configuration + variant: "" # @schema enum:['',upstream-alpine,enterprise-alpine,enterprise-distroless,enterprise-distroless-fips] + # -- Components https://fluxoperator.dev/docs/crd/fluxinstance/#components-configuration components: # @schema item: string; uniqueItems: true; itemEnum: [source-controller,kustomize-controller,helm-controller,notification-controller,image-reflector-controller,image-automation-controller,source-watcher] - source-controller - kustomize-controller - helm-controller - notification-controller - # -- Cluster https://fluxcd.control-plane.io/operator/fluxinstance/#cluster-configuration + # -- Cluster https://fluxoperator.dev/docs/crd/fluxinstance/#cluster-configuration cluster: # @schema required: true type: kubernetes # @schema enum:[kubernetes,openshift,aws,azure,gcp] size: "" # @schema enum:['',small,medium,large] @@ -25,19 +26,19 @@ instance: networkPolicy: true multitenant: false tenantDefaultServiceAccount: "default" - # -- Common metadata https://fluxcd.control-plane.io/operator/fluxinstance/#common-metadata + # -- Common metadata https://fluxoperator.dev/docs/crd/fluxinstance/#common-metadata commonMetadata: # @schema required: false labels: { } annotations: { } - # -- Storage https://fluxcd.control-plane.io/operator/fluxinstance/#storage-configuration + # -- Storage https://fluxoperator.dev/docs/crd/fluxinstance/#storage-configuration storage: # @schema required: false class: "" size: "" - # -- Sharding https://fluxcd.control-plane.io/operator/fluxinstance/#sharding-configuration + # -- Sharding https://fluxoperator.dev/docs/crd/fluxinstance/#sharding-configuration sharding: # @schema required: false key: "sharding.fluxcd.io/key" shards: [ ] # @schema item: string - # -- Sync https://fluxcd.control-plane.io/operator/fluxinstance/#sync-configuration + # -- Sync https://fluxoperator.dev/docs/crd/fluxinstance/#sync-configuration sync: # @schema required: false interval: 1m kind: "GitRepository" # @schema enum:[GitRepository,OCIRepository,Bucket] @@ -48,7 +49,7 @@ instance: name: "" provider: "" kustomize: # @schema required: false - # -- Kustomize patches https://fluxcd.control-plane.io/operator/fluxinstance/#kustomize-patches + # -- Kustomize patches https://fluxoperator.dev/docs/crd/fluxinstance/#kustomize-patches patches: [ ] # @schema item: object # -- Common annotations to add to all deployed objects including pods. diff --git a/packages/system/fluxcd/values.yaml b/packages/system/fluxcd/values.yaml index 7f5af0ffb..7c019aea0 100644 --- a/packages/system/fluxcd/values.yaml +++ b/packages/system/fluxcd/values.yaml @@ -5,7 +5,7 @@ flux-instance: domain: cozy.local # -- default value is overriden in patches distribution: artifact: "" - version: 2.7.x + version: 2.8.x registry: ghcr.io/fluxcd components: - source-controller